AP Networking 3.5: Controlling the Traffic with Firewalls and Filtering

A firewall reads its rule list top to bottom and executes the first rule that matches, then stops. That sentence drives everything here: choosing the right firewall for each segment, locking ports with MAC filtering, and writing an ordered access control list (ACL) that ends in a default deny.

In the Game Day scenario, Topic 3.4 segmented the tournament network: players on 172.16.10.0/24, judges on 172.16.20.0/24, staff on 172.16.30.0/24, spectators on 172.16.40.0/24. Segments only create boundaries. This topic staffs each one with a guard sized to its risk and hands it the list of what may cross.

• How a firewall decides: first match wins
• Choosing the firewall: level and placement
• MAC filtering: the allow list on the switch port
• Anatomy of a firewall rule
• Why rule order changes everything
• Building the Game Day rule set, step by step
• Practice: Rule Writer
• Letting AI draft rules, then auditing them
• Key terms
• Frequently asked questions

How a firewall decides: first match wins

Every firewall runs the same program. Traffic arrives at an interface, the firewall walks its access control list from the top, and the first rule whose criteria match gets executed, permit or deny. The walk ends there; rules below the match might as well not exist for that packet. An ACL is a sequence, and position is meaning. The habit to build: trace one packet through the list and stop at the first hit.

Choosing the firewall: filtering level and placement

Before writing rules, pick the guard. Two decisions: how deeply it inspects, and where it stands. Match both to the zone's risk.

Filtering level	What it does	Right zone for it
Stateless	Fixed rules on IP addresses, ports, or protocols; no memory of connections	Simple, low-risk segments, like the scoreboard displays
Stateful	Tracks active connections; can flag and log suspicious traffic	Zones needing connection awareness and logs, like the judge segment
Next-generation (NGFW)	Adds intrusion prevention and application-based filtering	High-risk zones needing detailed inspection, like the internet edge on game day

Placement	Where it stands	What it is for
Perimeter	Between the internal network and the internet	First line of defense; high volume, broad policy
Internal	Between internal segments	Blocks lateral movement; can carve out a screened subnet (DMZ) for public-facing services
Host-based	Software on one device	Endpoints that move between networks, like judge laptops

The trap: treating one strong perimeter firewall as protection for everything inside. The perimeter never sees traffic moving between the spectator Wi-Fi and the judge segment. Stopping lateral movement is the internal firewall's job.

MAC filtering: the allow list on the switch port

Firewalls filter conversations. MAC filtering filters membership: a filtered switch port accepts frames only from an approved set of hardware addresses and denies every other device before IP addresses even matter. Lock each player-zone port to its registered console, and the spectator who plugs a laptop into a free jack gets nothing.

The same control blocks a nastier attack. In MAC flooding, an attacker blasts the switch with frames from thousands of invented addresses until the CAM table, its map of which address lives on which port, runs out of memory. The switch fails open and broadcasts everything to everyone: the network congests, and the attacker reads traffic meant for other devices. A port that accepts only a few known addresses cannot overflow the table.

Anatomy of a firewall rule

A rule has three parts: the direction of traffic on an interface (inbound or outbound), the criteria to match (IP address, logical port, service, or application), and the action (permit or deny). A numbered list of them is an ACL. Here is the bracket server boundary:

101 ALLOW inbound TCP port 443 from ALL; 102 ALLOW inbound TCP port 22 from 172.16.30.0/24; 103 DENY inbound TCP ALL from ALL;

Read it like the firewall does. Rule 101: anyone may reach the secure web service. Rule 102: the staff subnet may reach SSH. Rule 103: everything else inbound dies. Three lines, the whole policy. Ports are the vocabulary here, and a handful cover most questions:

Port	Service	Keep or close?
443	HTTPS, secure web traffic	Keep where needed
53	DNS, name resolution	Keep; nothing browses without it
22	SSH and SFTP, secure remote CLI and file transfer	Keep, narrowed to the admin subnet
80	HTTP, unencrypted web	Close; 443 replaces it
23	Telnet, unencrypted remote CLI	Close; SSH replaced it
21	FTP, unencrypted file transfer	Close; use SFTP on 22

Notice port 22 doing double duty: SFTP runs over SSH, so one open port carries both secure services. Not a typo. Build every ACL to starve attackers: close unused and unencrypted ports, keep the services the segment needs, and let the default deny handle the rest.

Why rule order changes everything

The smallest useful rule set: staff may SSH into the judge segment, nothing else enters.

101 ALLOW inbound TCP port 22 from 172.16.30.0/24; 102 DENY inbound TCP ALL from ALL;

An SSH packet from the staff workstation at 172.16.30.10 hits rule 101 and passes. A probe on port 80 fails to match 101, falls to 102, and dies. Exactly the intent. Now reverse the two lines. The same SSH packet meets DENY ALL first and dies. Rule 101 still sits in the list, but no packet will ever reach it. Same rules, opposite networks.

The principle: specific rules go above broad ones, and the default deny goes last. Put the deny first "to be safe" and the boundary blocks its own allowed traffic; forget it and the boundary blocks only what you remembered to name. After any change, verify both directions: the allowed service works, a forbidden probe fails.

Building the Game Day rule set, step by step

The requirements: everyone views the bracket page; staff manage servers and switches; spectators get internet and nothing internal. The walk:

1. Place the public service. The bracket server takes connections from strangers, so it moves away from the tournament records into a screened subnet, 172.16.50.0/24, behind an internal firewall.

2. Write the specific allows. On the screened subnet boundary: inbound 443 from ALL and inbound 22 from 172.16.30.0/24 (staff SSH and SFTP uploads). On the judge boundary: inbound 22 from the staff subnet only.

3. End every list with the default deny. DENY inbound TCP ALL from ALL, last line, every boundary. That turns "I blocked the ports I thought of" into "I allowed the traffic I chose."

4. Verify from both sides. From a spectator phone, the bracket page loads and an SSH attempt to 172.16.50.5 fails. From the staff workstation, the SFTP upload succeeds. Ping across segments to confirm.

Practice: Rule Writer

Warm up with three sample questions, then build rule sets yourself in Rule Writer: assemble each boundary's ACL from a rule pool and test it.

Three free sample questions

1. An ACL reads: 101 DENY inbound TCP ALL from ALL; 102 ALLOW inbound TCP port 443 from ALL. Why does the bracket page fail to load?

Show answer

First match wins: every inbound packet hits the broad deny at 101, so the allow never fires. Specific above general (EK 3.5.C.4).

2. The judge segment needs connection tracking and logs, but no application-level inspection. Stateless, stateful, or NGFW?

Show answer

Stateful: tracking and logging connections is its exact feature set. Stateless has no memory; NGFW is over-buying (EK 3.5.B.2).

3. What stops a visitor's laptop the moment it is plugged into an open port on the player switch?

Show answer

MAC filtering on the port: only the registered console's address is permitted, all others denied (EK 3.5.A.1-2).

Now the full case set, shuffled every run; the tester walks your list exactly like a firewall would.

Letting AI draft rules, then auditing them

Handing an AI assistant a boundary's requirements and asking for an ACL draft is a fast first step. But AI-written rule sets fail the same ways student-written ones do, just more confidently, so audit line by line. Breadth: does any allow say ALL where the need names one service? "ALLOW inbound TCP ALL from the staff subnet" quietly admits Telnet from every staff machine. Order: does every rule actually fire, or does a broad line starve a specific one below it? Coverage: is there a default deny at the end? Then prove it on the network. AI drafts; the technician audits.

Key terms

Access control list (ACL)

An ordered list of firewall rules; the first matching rule is executed.

Default deny

The final, broadest rule: deny everything no earlier rule allowed.

Stateless firewall

Fixed-criteria filtering, no connection memory; for simple, low-risk segments.

Stateful firewall

Tracks active connections and can log suspicious traffic.

Next-generation firewall (NGFW)

Adds intrusion prevention and application-based filtering for high-risk zones.

Perimeter firewall

Guards the boundary between the internal network and the internet.

Screened subnet (DMZ)

A lower-security zone hosting public-facing services away from internal resources.

Host-based firewall

Firewall software on one device; its protection travels with the endpoint.

MAC filtering

A switch-port allow list of hardware addresses; all others denied.

MAC flooding

Overflowing a switch's CAM table to force fail-open broadcasting and intercept traffic.

Frequently asked questions

How does a firewall decide which rule applies?

It checks the ACL top to bottom and executes the first rule that matches, then stops. Rules below the match are never consulted.

Why does the order of firewall rules matter?

First match wins, so a broad rule above a specific one starves it. ALLOW port 22 then DENY ALL admits SSH; reversed, the deny fires first and SSH dies with everything else.

Where should the default deny rule go?

Last. It catches everything no earlier rule explicitly allowed, turning the ACL into a list of chosen permissions instead of blocked guesses.

What is the difference between a stateless and a stateful firewall?

Stateless applies fixed rules and remembers nothing about connections. Stateful tracks active connections and can flag and log suspicious traffic.

When is a next-generation firewall (NGFW) worth it?

In high-risk zones or wherever detailed inspection is needed: it adds intrusion prevention and application-based filtering. For a low-risk segment it is over-buying.

What is a screened subnet or DMZ?

A lower-security zone internal firewalls create for public-facing services: outsiders can reach them, while a boundary still protects everything internal.

Is MAC filtering the same as a Wi-Fi password?

No. A Wi-Fi password guards the wireless boundary; MAC filtering is an allow list of hardware addresses on a port, so unapproved devices are refused the moment they plug in.

What is MAC flooding and why does it work?

An attacker floods a switch with fake MAC addresses until the CAM table overflows. The switch fails open and broadcasts all traffic to every node, letting the attacker read data meant for others. Per-port MAC limits prevent the overflow.

Why block ports 80, 23, and 21?

HTTP, Telnet, and FTP all move data unencrypted, and each has a secure replacement: HTTPS on 443, SSH on 22, SFTP over SSH on 22. Closing them removes easy targets.

How do I verify firewall rules after configuring them?

Test both directions of the intent: confirm allowed traffic works and forbidden traffic fails, and ping across segments to confirm reachability matches the design.

AP is a trademark of the College Board, which was not involved in the production of, and does not endorse, this resource.